rsync from nas for immich

clusters/base/apps/immich/helmrelease-server.yaml

@@ -53,6 +53,46 @@ spec:
                 memory: 512Mi
               limits:
                 memory: 4Gi
+          # one-shot migration copy from the old NAS-hosted docker install
+          # into this install's own library volume (see "library" below).
+          # rsync is idempotent, so a pod restart mid-copy just resumes
+          # cleanly; once done it sleeps forever instead of exiting, so the
+          # container doesn't restart-loop and the status page stays up.
+          rsync:
+            image:
+              repository: python
+              tag: 3.13-alpine
+            command:
+              - sh
+              - -c
+              - apk add --no-cache rsync >/dev/null && python3 /app/rsync.py
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+          rsync-web:
+            image:
+              repository: nginx
+              tag: 1.27-alpine
+            probes:
+              # explicit port: this controller has two services (app:2283,
+              # rsync-web:80) and probe auto-detection picks the
+              # controller's primary service port rather than this
+              # container's own - without this it checks the wrong port.
+              liveness:
+                enabled: true
+                port: 80
+              readiness:
+                enabled: true
+                port: 80
+            resources:
+              requests:
+                cpu: 10m
+                memory: 16Mi
+              limits:
+                memory: 64Mi
 
     service:
       app:
@@ -60,6 +100,11 @@ spec:
         ports:
           http:
             port: 2283
+      rsync-web:
+        controller: server
+        ports:
+          http:
+            port: 80
 
     ingress:
       app:
@@ -78,6 +123,22 @@ spec:
           - secretName: immich-tls
             hosts:
               - photo.aggtaa.com
+      rsync-web:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: rsync.photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: rsync-web
+                  port: http
+        tls:
+          - secretName: immich-rsync-tls
+            hosts:
+              - rsync.photo.aggtaa.com
 
     persistence:
       # brand new, dedicated library - deliberately not reusing the old
@@ -90,3 +151,28 @@ spec:
         retain: true
         globalMounts:
           - path: /data
+      nas-source:
+        type: persistentVolumeClaim
+        existingClaim: immich-nas-source
+        advancedMounts:
+          server:
+            rsync:
+              - path: /source
+                readOnly: true
+      rsync-script:
+        type: configMap
+        name: immich-rsync-script
+        advancedMounts:
+          server:
+            rsync:
+              - path: /app/rsync.py
+                subPath: rsync.py
+                readOnly: true
+      rsync-www:
+        type: emptyDir
+        advancedMounts:
+          server:
+            rsync:
+              - path: /www
+            rsync-web:
+              - path: /usr/share/nginx/html